ENIGMA 2000 Newsletter - Issue 30

September 2005
Articles, newsreports and Items of interest :enigma2000-owner@yahoogroups.com

Voice stations | Oddities | Polytones
German branch | Numbers predictions
July 7th, 2005 | E22 analysis
Slavic stations | Feedback
HJH's watch | A room in Berlin
News Items | Web sites | Contribution deadlines
Index | E2K NL Home

Polytones

In this section we have more coverage of XPA after the XP files.

XP [1+12 Russian Intelligence Multitone System]

XP Daily Log MONTH: July 2005 [Underscore indicates tally mark present].

The first sending of July was an 83 group message with a good start to the schedule. However the second sending of 0620z was not heard by PLondon or JoA; both searching between 7000 to 13000kHz. The expected transmission at 0640z on 12117kHz was heard at good strength by JoA but PLondon’s reception was marred by some local QRM. It was a most peculiar signal and possibly emanated from a nearby Embassy.

The first message of July reads:

• XP 9317kHz 0600z 01/07/05 ID391 dk/gc 08247 00083

391 391 391 1 391 391 391 1 391 391 391 1 391 391 391 1
391 391 391 1 391 391 391 1 391 391 391 1 391 391 391 1
391 391 391 1
R>>>>>>>>>>>>>>>>>>> _________08247 00083 33684 51666
78903 67180 77877 87792 86354 13838 60412 51701 74312 86063
80536 61657 35624 50579 73965 79723 57379 23535 97855 82478
27015 85543 32434 16985 87566 73873 39312 09970 44234 31966
84021 38222 77675 24868 76488 68585 95911 87397 53843 31851
26712 92876 44704 97963 44235 18224 47171 26495 42641 93484
94834 61792 26507 31103 64481 08492 61977 61410 69388 08997
19724 17668 04116 63329 16648 27924 87584 71614 99141 71262
63723 15437 94978 83017 40017 12639 07538 69745 07197 83598
90578 <<<<<<<<<<<<<<<<<<

The message sent on Tues 19/07 was something of a rarity theses days and was the two message format:

• XP 10917kHz 0620z 19/07/05 ID391 dk/gc 02937 00019 / 00592 00195

391 391 391 2 391 391 391 2 391 391 391 2 391 391 391 2
391 391 391 2 391 391 391 2 391 391 391 2 391 391 391 2
391 391 391 2

******************* 02937 00019 49459 10628 32488 27723
54607 42830 41330 92841 35614 19832 90595 86487 64755 99686
29963 75157 33511 99790 39740_00000 00000 00592 00195 55478
59326 61690 18464 73188 04407 16786 92331 23446 24704 86578
91376 68579 41521 15728 52306 11466 61126 48463 51488 03928
80710 31924 65129 04161 56174 31047 89629 03051 17551 44330
72262 25922 73625 99249 69991 60377 65106 86913 90884 78305
34337 61631 82587 36819 64139 42767 13329 51806 32654 44436
38240 94123 77446 03544 23693 44436 58080 50987 25619 56306
92240 35421 18733 06669 74130 89000 75317 89190 96022 57600
51719 66992 09533 83302 94365 48977 79267 45350 92700 54111
58519 29279 16314 49995 75031 90998 68082 07915 42138 20631
26914 87899 21585 40414 86727 30835 13693 55591 76149 47928
57706 09463 16272 92311 50711 48415 36961 98571 67901 44632
29867 79619 86626 28779 30479 88517 80709 70439 71779 06126
32400 51150 44553 51647 21173 73760 44514 66007 51643 59857
72198 51704 88960 30952 55594 27223 50164 08232 98041 14045
79575 36067 60243 37445 62059 34422 49144 43868 51207 48598
09305 01441 16647 10143 73762 60335 50875 77238 19140 03965
84131 94190 20536 51366 98504 96227 74883 88223 89880 52696
97956 97624 48963 12533 74423 84565 53445 25287 70449 34376
92734 79391 99945 76102 83365 49856 71125 56190 54347 48005
02872 79074 68267 38544 ************

Note the first message is just 19 groups followed by the tally mark and then 00000 00000. The the message is a repeat of that sent Fri 15/07. [Also heard in Australia by SD].

©PBeaumont19thJuly2005

This spectrograph shows the last group 391 2 followed by ********** and the first mrssage upto the generation of two five character groups of zeroes. Looking along the bottom line the increased length 303Hz tone can be seen [mkd by an ‘X’] which is used to generate the ‘tally mark’. It is interesting to note that whilst ‘Xperta’ shows this mark other decoders do not.

The message sent on Friday 29/07 was unusually short. It read:

• XP 9317kHz 0600z 29/07/05 ID391 dk/gc 04509 00019

391 391 391 1 391 391 391 1 391 391 391 1 391 391 391 1
391 391 391 1 391 391 391 1 391 391 391 1 391 391 391 1
391 391 391 1

>>>>>>>>>>>>>>>>>>>> _________04509 00019 71129 58520
43631 22822 78943 62503 04901 30431 44212 61569 30557 06438
35575 91830 14254 68259 95990 51995 22848 <<<<<<<<<<<<<<
<<<<<<

Whilst as a spectrograph it looked like this:

©PBeaumont29thJuly2005

XP Daily Log MONTH: August 2005 [Underscore indicates tally mark present].

^ XPA sent 00167/00169 on 16/08 – same messahe different dk? Both systems attributed to Russian Intel systems

August transmission started using the expected frequencies and produced a sixty one group message:

• XP 9236kHz 0600z 02/08/05 ID225 dk/gc 00197/00061

225 225 225 1 225 225 225 1 225 225 225 1 225 225 225 1
225 225 225 1 225 225 225 1 225 225 225 1 225 225 225 1
225 225 225 1

R>>>>>>>>>>>>>>>>>>> _________00197 00061 74768 72293 14651
64803 79777 91773 44343 58836 78596 33251 77286 51527 14174
50062 30826 38725 39219 92584 52695 23951 59453 40779 76438
71053 51747 46806 74518 08609 53963 79695 08215 93879 18125
99667 63028 00323 65494 18035 78566 07704 71821 13279 84874
59395 73272 68591 25863 62873 48893 01846 00391 98496 51814
32967 23817 06476 11987 45560 86090 51517 20339 <<<<<<<<<<<
<<<<<<<<<

From the tones illustrated in this spectrogram:

©PBeaumont2ndAugust2005

The second transmission went well until the message proper started. As the synchronising pulses finished a strong, modulated carrier cut across the sending and obliterated a good proportion of the message, as shown on the spectrogram:

©PBeaumont2ndAugust2005

The missing groups, or rather the remaining ones, can be easily seen. The actual effect to the message was this:

• XP 0620z 10236kHz ID225 [othet details missing]

225 225 225 1 225 225 225 1 225 225 225 1 225 225 225 1
225 225 225 1 225 225 225 1 225 225 225 1 225 225 225 1
225 225 225 1

R>>>>>>>>>>>>>>>>>>> 7 _ ____ ____<_____ ______ ___9________
__________< ________9______R7__________________6 _____<_____
____7____82___9725 39219 ___________ 2___1 59453 40779 76438
71053 51747 46806 74518 08609 53963 79695 08215 93879 18125
99667 63028 00323 65494 18035 78566 07704 71821 13279 84874
59395 73272 68591 25863 62873 48893 01846 00391 98496 51814
32967 23817 06476 11987 45560 86090 51517 20339 <<<<<<<<

Note the dk and gc is missing and that ‘normal service’ is only resumed with group 21. The 3^rd sending was completed with little QRM, save for a facsimile transmission prior to the expected intro of 225 225 225 1 procedure. [This was also experienced on the 0620z 30/08 sending although Fer in Holland did not hear the interfering data carrier].

The majority of sendings are null sendings. It was a glut of null messages that preceeded the fall of the Sched 1,2 & 3 messages, although the Sched 2 messages [Tues/Fri] appears to have been replaced by the recently discovered XPA sched at the same time.

Due to the recent finding of XPA on the ‘apparent’ old XP Sch2 we reprint our original paper derived from the first received signals.

Since the publication of this doc PLondon has reassessed the tones, which vary slightly. These are printed at the end of the original doc, along with logs.

XPA [MFSK-20 Russian Intelligence Multitone System]

ML sent an email [dated 26/07] to the effect:

“Was doing a scan in 10Mc/s hunting for an evening E22 when I hit a promisingly strong carrier of S9+20 at 19.53z. At 19.59z a rasping tone similar to but rougher than that on E22.

At 20.02 ‘til 20:03.45z typical polytone tone sequence, freq was 10416kHz - close to a known M24 freq.”

PLondon checked his records and was unable to confirm any known Polytone freq between 10264kHz [used12/2003] & 10601kHz [used 08/2002],

The last time a Schedule 1 and 2 transmissions were intercepted [July 03] the frequencies vs time were:

RNGB writes:

"Heard XPA this evening 12/07 (after a long absence). It was at 2000z on 10416kHz and again at 2020z on 9252kHz. There appeared to be no message. Or if there it was extremely short.

"It started with the usual 2 tone sequence for a minute then a few jingles and stopped. Transmitter dropped off line immediately."

[Tnx RNGB]

©PLondonJuly2005

This was also heard by ML as mentoned above. A spectrogram was produced. Whilst it sounded like XPA it did display some variation as noted by RNGB, JoA and PLondon. [See repeat of our measurements taken in Dec 2003]. ML commented:

"Have played around with the sound sample today and been comparing it with the sample.jpg's you sent me of XPA on 4th July, the intro & synchro are almost identical as is the mssg header - from a purely Spectogram visual perspective.

At this point it changes when one looks closely:-

• There are not 4 x 64grps there are 2 x 64 plus 1 x 33 (32?)grp.
• The tones do not tie up with those for XPA, highest and lowest are :-
• Leadin: 482 / 1247Hz, 385 / 1603 msec, start high.
• Pulse train 16 alternating pairs of 565 / 1082Hz, burst of 802 / 963Hz and a 888Hz long tone (875 msec), start low
• Synchro: 640 /963Hz, start low
• Repeat of pulse train and long tone, with 802 / 963 a different pattern, start low
• Pulse train of 10 pair 1125 / 1168Hz, start high
• Long tone 640Hz, 500 msec
• Mssg: 640 / 1168Hz
• There would appear to be 12 tones used in the mssg structure.

These are near to but not exactly the same as XPA, maybe a better recording will give alternative results"

MikeL’s XPA message – compare structure with earlier trace. [Different timebase used]

©MikeL12thJuly2005

To explain XPA, we once again include the original notes compiled on this interesting polytone:

XPA, previously UNID Polytone

On Wednesday 3 ^rd December, 2003 RNGB noticed a strong carrier on 6913kHz. Having waited there he was rewarded with a polytone like signal at 1750z, the sending lasted for two to three minutes.

A similar finding was made by RN GB on 8192kHz at 1710z on Friday 5^th December, 2003 at 1710z and again at 1750z on 6913kHz. RN reported that the transmissions were ‘of the same structure but were not the same.’

RN GB again heard the transmission weakly on Monday 8^th December, 2003 at 1710z on 8192kHz and again on 6193kHz at 1750z. That sending was much stronger and a recording of it was sent to ENIGMA 2000 for further analysis.

RN GB noted that the messages came in blocks of 64.

RN GB also carried out some analysis of the tones used and formed the basis for an exact measurement and analysis of this unknown.

©PLondonDec2003

Tones

See later after this article

The following tones were noticed during frequency analysis using ‘Cool Edit’. [Errors expected].
471, 515, 520, 592, 654, 672, 708, 711, 755, 796, 839, 881, 922, 960, 988, 1000, 1010, 1015, 1020, 1045, 1060, 1086, 1110, 1126, 1145Hz.

Following RN GB’s example numerical/functional values were applied to the audio frequencies seen:

Structure of message submitted

The transmission commenced with two tones toggling for 59s. The low tone was 471Hz and had a duration of 0.0482s whilst the high tone 1145Hz, each lasting 1.615s. The signal commenced with the high tone.

At the end of the slow tones a pulse train of 16 high and 16 low tones were sent alternately for 1.597s, the high 1015Hz tone leading in, followed by a 515Hz tone. Each tone was 0.054 long.

That led into a seven character pulse sequence starting on the high tone, finishing on the low:

The sending lasted 0.654s

A complicated tone structure followed; a series of synchronised two high and two low tones were sent for 2.097s. The high tones are designated h1 and h0, the lows, l1 and 10. This sending lasted 2.097s.

The sending commenced with h0/l1 and ended with h1/l0.

Then an eighteen tone sequence followed starting on the low tone of 515 and toggling to 1110Hz, the repeat command for this series, ran for 1.631s in total.

That led directly to the same seven tone sequence outlined above via a 768Hz tone:

Again for 0.654s.

On completion of the seven tone sequence another pulse train started on the high tone of 1110 and toggled ten times to 1086Hz, dropping at the last low tone after 1.000s.
For 0.500s a 592Hz tone led into the message proper:

In the message each pulse was measured as lasting just 0.046s.

The first ten groups of five characters plus the space tone read:

The accurately measured time to send these ten message groups was 3.003s; therefore a mean time to send one group is 300.3ms. [Measurement made by Cool Edit].

03209 00279 32579 74608 55314 74252 82286 16327 44979 87283

RNGB discovered that the message blocks consisted of 64 groups, within the entire message sending he also saw that four block of 64 plus 25 separate five character groups had been sent.

In other polytone systems the first two groups are the decode key [dk] and the group count [gc].

This was not missed by RN GB; 64 x4 + 25 = 281 – 2 [the dk/gc grps] = 279.

That is the actual number of groups sent [and certainly as expected by other polytone ‘rules’].

Rest of groups for two messages follow. An audit on the ‘space’ tone, 592Hz confirmed that for each group to be sent, 5+1 took just 0.3seconds. From Group 11:

30549 80119 22813 61903 49837 22723 22075 86352 35851 52863
93692 65534 55137 49033 45541 56729 38339 32264 19174 90948
43392 84899 51713 42676 71481 52830 06156 47454 20349 55234
61440 13338 42545 89839 03223 80933 98955 63255 44423 25741
26588 07759 13196 27830 62349 33139 76358 99550 38018 24557
53891 46293 08218

[Seven tone group nnn in Hz, x.xxxs in seconds]:

[from grp 65]:

32663 42097 21616 51747 72201 61989 07136 00039 02609 85942
58233 54193 44377 97273 76201 05110 83434 30582 31569 55293
35393 30188 34655 06025 75562 30715 30550 40685 97175 43488
33117 93431 37926 41667 70295 04745 90426 92151 73367 12974
55441 37123 50468 06547 08118 81469 51598 51320 71597 05868
87038 36367 65331 64435 85913 69551 55139 43712 29986 72514
50280 56842 35998

This sequence of seven tones then 64 grps continues twice more for a total of 256 groups, followed by the identical seven tones then 25 grps.

On the 24^th group 55003 the space tone, 592Hz had a duration of 100ms instead of the usual 50ms. The last group is 71566. The last figure is a repeat of the preceding 922Hz tone and in this case must be the repeat tone 1112Hz. This runs nicely into the 10 low and 10 high tones that close the message transmission.

Lasting 1.011s the tones toggle between 631 and 1126Hz.

Whilst the message body has been reasonably understood and numerical values or function applied to the tones the other tonal functions are unknown.

The initial sequence was compared with another sample received from JoA, on his sample the long/short 1145/471Hz tones ran for 1minute, but the ‘construction’ of the message appeared the same as that supplied by RN GB. The purpose of this signal is fairly obvious and wakes the receiving apparatus readying it for the automatic reception of its signal.

Then the signal changes to a 16h/16l tones, 1015/515Hz. There then follows seven alternate pulses, 922/755Hz with variation on length. This type of signal is seen at the end of the intro [maybe ‘administration’] sequence before the message proper starts. It also appears after each 64^th group although the times are different, it still makes 6 2 6 2 6 2 6. Perhaps this triggers a part of the receiving/recording/synchronisation apparatus?

After the seven tones a 838Hz tone is sent for 1s this the followed by the same seven tone sequence, obviously switching something, then follows a complicated 4 tone sequence as h1 1020, h0 988, l1 708, l0 590Hz.

The top lines h1/h0 are and sent in three groups of three hl/h0. The bottom lines L1/L0 are sent in 3L1 then two L0/L1 the res varying in length – apparently. Those must perform a special task, perhaps the recognition of a signal or the type of decode method used or perhaps authentication. Either way it is a complicated pulse train.

Then an eighteen tone sequence followed starting on the low tone of 515 and toggling to 1110Hz, the repeat command for this series, ran for 1.631s in total as mentioned at the beginning. These lead into another seven tones 6262626 separated by a long 840Hz tone of 1.023s duration, then the same seven tone 6262626 sequence which leads on to a high tone toggle sequence.

The tones are 1110 and 1080Hz, each of 0.050s duration. Ten of each tones are sent over a period of 1s.

Immediately the tones are complete a space tone, 592Hz, is sent for 500ms. After that the messages proper are sent. Each block of 64 groups separated by the seven tone 6262626 sequence. At the end of the message 10 low and 10 high tones close the message transmission. Lasting 1.011s the tones toggle between 631 and 1126Hz.

The carrier then drops.

Further interceptions were made of this signal by JoA and PLondon as well as RN GB.

However, the original intercepted signal was in AM, the later ones were only audible with USB selected.

With this change of mode an offset of frequency was noticed on the tones. Nonetheless using the ‘space’ tone [592Hz] as the basis the offset was easily calculated by simple subtraction and appeared to be a constant across the message to which it was applied.

With PLondon and RN GB intercepting the signals they independently ‘decoded’ the tones and agreed on the dk/gc for at least one sending:

The probability of these signals being involved with automated collection at the receiving end prompts us to make the designation XPA

E2k thanks RNGB, JoA, PLondon and those who assisted with the derivation of this analysis. ©PLondonDecember2003

Update

Further thoughts on signal content, prompted by AnonUK

Re trains of 'meaningless' figures; possibly command lines for whatever machine is used to receive the transmission.

For instance:

• 426 426 426 000
  ID and Msg indicator
• 03954
  probably a message serial number, known to vary
• 00001
  start of a close down sequence
• 00000
  command to reset all registers
• 10140
  disconnect/ready command

If you look at the way the message is sent it is in 64 groups - very ‘binary’ that and no doubt a counting form for the registers.

The message preceding/succeeding group of

suggests an indicator of some kind for the message proper - it is common to both full and null messages so could well be a command line to suggest a decode function of what we receive as numbers? It doesn't appear at the end of the message so probably reset by the end tone low/repeat conclusion.

[Tnx AnonUK]

Latest reports

Moving on to August 2005, PLondon received a telephone call on 02/08 from RN GB reminding him to listen to XPA [huge carrier up]:

©PBeaumont03/08/05

Note the ending of this *Null* message – is it 00000?

The 02/08 sending was recieved in AM by PLondon and at good strength +20dBs/9 for the 2000z and a variable S7-9 for 2020z. [Similar with RN GB too].

PLondon reported, 'The freqs of the tones were still high and I suggest the freq of the tones do not overly matter. That can be equated to the pulse trains used on a car plip key. As long as they exist in the right order the locks operate, irrespective of any slight variation of the tonal frequency that may exist.[Learnt from working on the plip key of the Chairman of a Company he once worked for]!

The second sending for XPA is on 9252kHz at 2020z.

RNGB had rang me last night and we had a discussion about XPA. Given the short null message last night - and what occurs when a full message is sent RN suggested as we had indeed stated from the discovery of this Polytone transmission: Automatic reception.

Furthermore RN also stated that the usual XP evening schedules 1, 2 and 3 that suddenly disappeared were never *apparently* replaced. Yet here we have with some regularity a Tuesday and Friday sending - at the right times but different freqs - XPA. [The old XP Schedule 2 transmissions].

MikeL noted the details of the 02/08 sending as:

Details :-

RN GB has identified XPA as the Russian Intelligence Multitone System, MFSK-20 and further suggests it as a replacement for the XP evening schedules. XP being the 1+12 Russian Intelligence multitone system.

PLondon returned home from a funeral on 09/08 at Three Bridges, Sussex. He was surprised to see a number of armed police on the railway station, not the weapons but that someone considered Three Bridges to be a terrorist target. After his evening meal he set out to intercept XPA on 10416 and 9252kHz. Luckily the transmission was a full message and the third frequency discovered to be 7654kHz.

PLondon expected to find an ID and it was found in the section shown as ‘A’ in MikeL’s image at the start of this section’

Comparing XPA with XP [or XPH] one would expect the ID to repeated for a specific number of times – in this case: 426 426 426 1 repeated three times.

The ID is generated by the 100kHz value of each frequency used. Here we can see the construction of the section labeled ‘A’ [MikeL’s trace just prior to start of this piece] in a different perspective:

Received tones used for the original determination were found to be 88Hz higher [nnn] that our nominal freqs and with correction:

4 832[920]; 2 754[842]; 6 910[998]; Space[Sp] 593[581]; 1 713[801]; Sp 593[581]

The dk/gc was 04652/00133. The message groups were counted as 64 x2 = 128 + 7 = 135 – dk/gc = 133grps

Received tones used for the original determination were found to be 88Hz higher [nnn] that our nominal freqs and with correction:

Logs for the XPA transmissions read:

©PLondon230805

Spectrogram shows the end characters as reported by PLondon 2000/2020z 23/08 [02687 00001 00000 10140]

©PLondon260805

Spectrogram shows the end characters as reported by PLondon 2000/2020z 26/08 [03954 00001 00000 10140]

On perusal of the end tones of the null messages it seems the first group after the long space is a variable; perhaps a serial number? The ‘10140’ may well reset the machine for the next message.

*PLondon stated the dk/gc of the 12/08 sendings incorrectly – luckily RNGB was able to offer a correct analysis. However a difficulty was noticed with the conversion of the tones [albeit through some very local noise] and PLondon reassessed the tones that he had currently received and measured them to be:

There are tones that appear to have no particular function in the analysis we carry out. With the suggestion that the system is an automatic one it is more than likely these tones are supervisory tones, some involved with selective calling, others in remote unit operation.

©PLondon160805

Above illustrates XPA 7654kHz 2040z 16/08/05 [426 1 00167 00169] PLondon

Thanks for the input to XPA from AnonUK, DoK, E, RNGB, and PLondon

ENIGMA 2000 are always interested in receiving reports for this interesting station.

Voice stations | Oddities | Polytones
German branch | Numbers predictions
July 7th, 2005 | E22 analysis
Slavic stations | Feedback
HJH's watch | A room in Berlin
News Items | Web sites | Contribution deadlines
Index | E2K NL Home